CVE-2026-1584 — NULL Pointer Dereference in Langroid

CWE-476 — NULL Pointer DereferenceCWE-94 — Code Injection8 documents6 sources
Severity
7.5HIGHNVD
GHSA9.8
EPSS
0.1%
top 71.12%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
LangroidDebian Gnutls28
Timeline
PublishedApr 9

Description

A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello message with an invalid Pre-Shared Key (PSK) binder value during the TLS handshake. This can lead to a NULL pointer dereference, causing the server to crash and resulting in a remote Denial of Service (DoS) condition.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶debiandebian/gnutls28< gnutls28 3.8.12-1 (forky)
▶PyPIlangroid/langroid< 0.59.32

🔴Vulnerability Details

2
GHSA
GHSA-92xv-mw29-x4px: A flaw was found in gnutls↗2026-04-09
▶
GHSA
Langroid has WAF Bypass Leading to RCE in TableChatAgent↗2026-02-02
▶

📋Vendor Advisories

2
Red Hat
gnutls: gnutls: Remote Denial of Service via crafted ClientHello with invalid PSK binder↗2026-02-09
▶
Debian
CVE-2026-1584: gnutls28↗2026
▶

🕵️Threat Intelligence

3
Wiz
CVE-2025-14831 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2025-9820 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-1584 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶